Riskcovery

CVE-2025-5878

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

State
Published
Severity
6.9 Medium
Published
Jun 29, 2025
Updated
Nov 3, 2025
Reserved
Jun 8, 2025

Read the record on cve.org

Description

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:CVulDB
3.07.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:CVulDB
2.07.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:CVulDB

Weaknesses

  • CWE-138 Improper Neutralization of Special Elements
  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
esapi-java-legacyESAPI
  • 2.0-rc10Affected
  • 2.0-rc11Affected
  • 2.0.1Affected
  • 2.0GA1Affected
  • 2.1.0Affected
  • 2.1.0.1Affected
  • 2.2.0.0Affected
  • 2.2.0.0-RC1Affected
  • 2.2.0.0-RC2Affected
  • 2.2.0.0-RC3Affected
  • 2.2.1.0Affected
  • 2.2.1.0-RC1Affected
  • 2.2.1.1Affected
  • 2.2.2.0Affected
  • 2.2.3.0Affected
  • 2.2.3.1Affected
  • 2.3.0.0Affected
  • 2.4.0.0Affected
  • 2.5.0.0Affected
  • 2.5.1.0Affected
  • 2.5.2.0Affected
  • 2.5.3.0Affected
  • 2.5.3.1Affected
  • 2.5.4.0Affected
  • 2.5.5.0Affected
  • and 4 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.